ICONICS GENESIS64 CVE-2026-16436

The specific prerequisite is possession of the system 'unlock' challenge response, which the vendor states is common to all users and fixed across installations - so the attacker must first obtain this single static value 'by some means' (this is the CVSS AT:P attack requirement). Once that value is known it is universally reusable, since it is not per-user or per-installation. Exploitation requires network reachability to the affected ICONICS/GENESIS, GENESIS64, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, or BizViz component (AV:N) and NO authentication (PR:N) and NO user interaction (UI:N). The primary limiting factor is therefore the one-time effort to acquire the fixed challenge response; there is no required login, no victim interaction, and no documented non-default configuration needed beyond the system being deployed and network-accessible.

This is a genuine high-priority issue, not merely a high-CVSS paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), scoring 9.2 (Critical). The root cause (CWE-640) is severe by design: per the description, the unlock challenge response is COMMON to all users and FIXED, meaning a single secret - once recovered - works everywhere across every affected installation, which is exactly the kind of systemic weakness that tends to spread quickly once disclosed. The one tempering signal is AT:P (Attack Requirements: Present), reflected in the phrase 'by obtaining the challenge response by some means' - the attacker must first acquire that fixed response, so exploitation is not purely spray-and-pray. Conflicting/missing data must be stated: there is NO EPSS score, NO CISA KEV listing, NO SSVC decision data, and NO public POC in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation despite the critical score. The high CVSS therefore reflects design severity and worst-case impact, while the real-world exploitation likelihood currently depends on how easily the common/fixed challenge response can be obtained or reverse-engineered - a factor the vendor advisory (2026-006) should clarify.

A remote attacker targeting an exposed ICONICS/GENESIS SCADA/HMI server obtains the fixed, universal challenge-response value (e.g., by extracting it from the software, a leaked sample, or another compromised deployment) and replays it to unlock the system without any valid user account. Once unlocked, the attacker reads or tampers with industrial process data and configuration, or forces the HMI/historian into a denial-of-service state. No public exploit identified at time of analysis, but the shared/fixed nature of the secret makes a reusable tool straightforward once the value is known.